mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-10 05:17:18 +00:00
marc
a9dcf48e65
The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
73 lines
2.4 KiB
Plaintext
73 lines
2.4 KiB
Plaintext
{
|
|
"duration": "24h",
|
|
"description": "Active threats and detection triggers across OCSF sources",
|
|
"graphs": [
|
|
{
|
|
"title": "About This Dashboard",
|
|
"graphStyle": "markdown",
|
|
"markdown": "## OCSF Threat Detection\nMonitors suspicious activity patterns across all OCSF-normalized log sources.\n\n**Key Indicators:**\n- Brute force attempts (3+ failed logins)\n- Port scanning (5+ unique ports)\n- Suspicious process execution\n- Lateral movement indicators",
|
|
"layout": {
|
|
"w": 60,
|
|
"h": 6,
|
|
"x": 0,
|
|
"y": 0
|
|
}
|
|
},
|
|
{
|
|
"title": "Brute Force Attempts",
|
|
"graphStyle": "table",
|
|
"query": "message contains 'Failed password' or message contains 'authentication failure' | group failed_attempts=count() by src_ip, user_name | filter failed_attempts >= 3 | sort -failed_attempts | limit 20",
|
|
"layout": {
|
|
"w": 30,
|
|
"h": 14,
|
|
"x": 0,
|
|
"y": 6
|
|
}
|
|
},
|
|
{
|
|
"title": "Port Scan Sources",
|
|
"graphStyle": "table",
|
|
"query": "action = 'deny' dstport = * srcip = * | group hits=count() by srcip, dstport | group unique_ports=count() by srcip | filter unique_ports >= 5 | sort -unique_ports | limit 15",
|
|
"layout": {
|
|
"w": 30,
|
|
"h": 14,
|
|
"x": 30,
|
|
"y": 6
|
|
}
|
|
},
|
|
{
|
|
"title": "Suspicious Process Execution",
|
|
"graphStyle": "table",
|
|
"query": "message contains 'mimikatz' or message contains 'psexec' or message contains 'netcat' or message contains 'reverse shell' or message contains 'powershell -enc' | columns timestamp, serverHost, message | limit 50",
|
|
"layout": {
|
|
"w": 60,
|
|
"h": 14,
|
|
"x": 0,
|
|
"y": 20
|
|
}
|
|
},
|
|
{
|
|
"title": "Lateral Movement Indicators",
|
|
"graphStyle": "table",
|
|
"query": "(dstport = 22 or dstport = 3389 or dstport = 445 or dstport = 5985) srcip = * | group conns=count() by srcip, dstport | filter conns >= 3 | sort -conns | limit 15",
|
|
"layout": {
|
|
"w": 30,
|
|
"h": 14,
|
|
"x": 0,
|
|
"y": 34
|
|
}
|
|
},
|
|
{
|
|
"title": "C2 Beacon Activity",
|
|
"graphStyle": "stacked_bar",
|
|
"xAxis": "grouped_data",
|
|
"query": "(dstport = 4444 or dstport = 8080 or dstport = 1337) srcip = * | group count() by srcip | sort -count | limit 10",
|
|
"layout": {
|
|
"w": 30,
|
|
"h": 14,
|
|
"x": 30,
|
|
"y": 34
|
|
}
|
|
}
|
|
]
|
|
} |